Welcome to Splunk Answers, a Q&A forum for users to find answers to questions about deploying, managing, and using Splunk products. Contributors of all backgrounds and levels of expertise come here to find solutions to their issues, and to help other users in the Splunk community with their own questions.

This quick tutorial will help you get started with key features to help you find the answers you need. You will receive 10 karma points upon successful completion!

Refine your search:

Command prompt MSI installation - does this look right?

0

I was wondering if there is a switch for the MSI installation that will limit the log files to current data only on installation of Splunk on Windows. in addition, can you review my MSI script, we only want to forward Windows Security Events.

I found in the forum there is a different way of installing that sets current_only in one of the configuration files. We would prefer to use the MSI installation method.

my current MSI deployment is to only forward Security events, we would like to only forward current data.

People who like this

3 Answers

ftk is correct, there's no way to specify the current_only flag with the CLI.

For a large scale implementation, deployment server is definitely the way you should be heading. With that in place, all you would need to do at installation time is just a vanilla install, and then the first time you start it up run the command to enable the deployment client. It will then go off and grab all the configs you need -

splunk set deploy-poll <IP address or hostname>:<port>

In the next major version we will be adding a flag to the CLI MSI install that will allow you to configure the deployment feature at install time, but for now it will have to be an extra step.

This setting is not exposed via a command line switch. I recommend you use the LAUNCHSPLUNK=0 switch to not start splunk after installation, then edit your inputs.conf (or drop a standard one into place) to include the current_only setting, and then finally starting the splunk instance with the new config in place.

This can all be added to a simple batch script that can easily be farmed out to all your servers.

Alternatively I would look into using a deployment server to push out the configurations to your forwarders.